From 65a30f7bab69292d5009e4b10ae084ff970ac1b2 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 25 Jun 2026 11:31:09 +0200 Subject: [PATCH] child-create: Fix crash when responder doesn't send TS payloads There are multiple paths that can trigger a crash. One is if transport mode is negotiated via NAT and `get_transport_nat_ts()` is called to substitute addresses in the received TS. If that's not the case, `narrow_ts()` will select the configured TS and continue. Then, `narrow_and_check_ts()` eventually attempts to destroy `this->tsi/tsr`, which triggers a crash in any case. The referenced commit refactored `select_and_install()` into `narrow_and_check_ts()` and `install_child_sa()`. It move a check for TS from that function to only `build_r()`. Fixes: d7760416d62d ("child-create: Add support for multiple key exchanges") --- src/libcharon/sa/ikev2/tasks/child_create.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index dbde6ff91..4649cbf8e 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -2712,6 +2712,13 @@ METHOD(task_t, process_i, status_t, process_payloads(this, message); + if (!this->tsi || !this->tsr) + { + DBG1(DBG_IKE, "TS payloads missing in message"); + handle_child_sa_failure(this, message); + return delete_failed_sa(this); + } + if (!select_proposal(this, no_ke)) { handle_child_sa_failure(this, message);